US Senate website says use HTTP instead of HTTPS • Hacker News Board

Re: US Senate website says use HTTP instead of HTTPS

#51

Post by gcb0 » Fri, May 06, 2016, 7:51 AM UTC

sdiq wrote: post #47

demarq wrote: post #15

I also noticed it seems blocked from access outside the US... so what would happen if a traveling american wants to access it? edit: FYI I'm trying from Kenya. edit2: Using my phone I'm able to switch between wifi, and mobile and on mobile it is unblocked. hmmm Also for those who don't see the Access Denied page but are curious, here is what it reads in full. -------------------- Access Denied You don't have permissi…

Just tried from Kenya and did not see any "ACCESS DENIED". This is what I am seeing: "Request unable to be completed. The submitted https request was not able to be completed at this time. Please retry your request using http. This may require disabling some browser based plug-ins." Maybe something to do with your browser? Edit: typo.

or that is the very man-in-the-middle attack https would have prevented... we will never know.

Re: US Senate website says use HTTP instead of HTTPS

#52

Post by rhyzomatic » Fri, May 06, 2016, 7:56 AM UTC

demarq wrote: post #15

I also noticed it seems blocked from access outside the US... so what would happen if a traveling american wants to access it? edit: FYI I'm trying from Kenya. edit2: Using my phone I'm able to switch between wifi, and mobile and on mobile it is unblocked. hmmm Also for those who don't see the Access Denied page but are curious, here is what it reads in full. -------------------- Access Denied You don't have permissi…

No problems from Hong Kong.

Re: US Senate website says use HTTP instead of HTTPS

#53

Post by jrapdx3 » Fri, May 06, 2016, 7:58 AM UTC

Attempted to write to one of my senators. To do so online requires using the web form on the senator's "contact" page. It says only messages from the senator's constituents will be accepted, so it's necessary for the author to share some identifying info.

I don't know how much checking is done to assure the writer really is a constituent, probably there's some lookup of street addresses, zip codes, etc.

Main point is that the senator's contact page does use https. This is appropriate given that personal info is shared per the contact form. I don't think any other senate pages accept input, so maybe their reasoning is that http vs. https is less critical on other parts of the site.

Re: US Senate website says use HTTP instead of HTTPS

#54

Post by sxg » Fri, May 06, 2016, 8:01 AM UTC

demarq wrote: post #15

I also noticed it seems blocked from access outside the US... so what would happen if a traveling american wants to access it? edit: FYI I'm trying from Kenya. edit2: Using my phone I'm able to switch between wifi, and mobile and on mobile it is unblocked. hmmm Also for those who don't see the Access Denied page but are curious, here is what it reads in full. -------------------- Access Denied You don't have permissi…

I'm a traveling American, and I can't see it in Singapore.

Re: US Senate website says use HTTP instead of HTTPS

#55

Post by cbd1984 » Fri, May 06, 2016, 8:09 AM UTC

raimille1 wrote: post #24

Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.

Why is most of your mail sent in envelopes as opposed to on postcards? Why don't people default to postcards, and only use envelopes when they have something to hide?

This isn't about traffic analysis, it's about social expectations and social norms. If privacy is the default, the social norm is to be private, and to expect privacy. That's important.

Re: US Senate website says use HTTP instead of HTTPS

#56

Post by Reason077 » Fri, May 06, 2016, 8:15 AM UTC

I'd forgotten how fast everything loads if you use http instead of https.

It's quite refreshing to not have that initial half-second or so lag that you get when loading an https page.

Hopefully we'll make back some of the difference once http/2 is more widespread.

Re: US Senate website says use HTTP instead of HTTPS

#57

Post by Intermernet » Fri, May 06, 2016, 8:16 AM UTC

raimille1 wrote: post #24

Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.

Apart from the issue with MITM attacks, they will be forever stuck on HTTP version 1 due to the fact that hardly any web-server or browser vendor plans on implementing HTTP2 without HTTPS. plain HTTP is in the spec, but it seems to be that most vendors are deliberately leaving it out (something I agree with).

From the IETF HTTP WG FAQ:

>"Does HTTP/2 require encryption? No. After extensive discussion, the Working Group did not have consensus to require the use of encryption (e.g., TLS) for the new protocol.

However, some implementations have stated that they will only support HTTP/2 when it is used over an encrypted connection, and currently no browser supports HTTP/2 unencrypted."[1]

From Wikipedia:

> "Although the standard itself does not require usage of encryption, most client implementations (Firefox, Chrome, Safari, Opera, IE, Edge) have stated that they will only support HTTP/2 over TLS, which makes encryption de facto mandatory."[2]

From NGINX:

> "Using HTTP/2 is likely to improve website performance if you’re using SSL/TLS (referred to as TLS from here on). But if you have not, you’ll need to add TLS support before you can use HTTP/2"[3]

From Daniel Stenberg:

>"Reasons for choosing TLS-only include respect for user's privacy and early measurements showing that new protocols have a higher success rate when done with TLS. This because of the widespread assumption that anything that goes over port 80 is HTTP 1.1 makes some middle-boxes interfere and destroy traffic when instead other protocols are communicated there."[4]

[1]: http://http2.github.io/faq/#does-http2-require-encryption

[2]: https://en.wikipedia.org/wiki/HTTP/2#Encryption

[3]: https://www.nginx.com/blog/7-tips-for-faster-http2-performan...

[4]: https://daniel.haxx.se/http2/http2-v1.10.pdf

Re: US Senate website says use HTTP instead of HTTPS

#58

Post by tdkl » Fri, May 06, 2016, 8:20 AM UTC

cbd1984 wrote: post #55

raimille1 wrote: post #24

Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.

Why is most of your mail sent in envelopes as opposed to on postcards? Why don't people default to postcards, and only use envelopes when they have something to hide? This isn't about traffic analysis, it's about social expectations and social norms. If privacy is the default, the social norm is to be private, and to expect privacy. That's important.

Commercial mass mail for informing isn't sent in envelopes. I presume that's what the parent was talking about.

Re: US Senate website says use HTTP instead of HTTPS

#59

Post by blackhaz » Fri, May 06, 2016, 8:27 AM UTC

blowski wrote: post #50

blackhaz wrote: post #39

Earlier quoted context omitted.

I can save about 30% of traffic by optimizing content via HTTP. Can't do that with HTTPS without MITM or similar questionable practices breaking the purpose of HTTPS. While you're sitting on a 100+ Mbps DSL, somebody in the middle of Africa is struggling on an ISDN-like link.

Optimise for the most common case. I imagine there are far more people in the US with broadband connections being put at risk of MITM attacks than people in Kenya with very slow internet trying to look at the US governments website.

I am not against HTTPS per se. Use it for sensitive content.

Re: US Senate website says use HTTP instead of HTTPS

#60

Post by majewsky » Fri, May 06, 2016, 8:33 AM UTC

tdkl wrote: post #58

cbd1984 wrote: post #55

Earlier quoted context omitted.

Why is most of your mail sent in envelopes as opposed to on postcards? Why don't people default to postcards, and only use envelopes when they have something to hide? This isn't about traffic analysis, it's about social expectations and social norms. If privacy is the default, the social norm is to be private, and to expect privacy. That's important.

Commercial mass mail for informing isn't sent in envelopes. I presume that's what the parent was talking about.

It isn't? At least in Germany, commerical mass mail is always sent out in envelopes.

I guess that, in this particular case, the reason for the envelopes is to conceal the ads inside them until the recipient has taken the time to open the envelope.